Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/21/2013
12:25 AM
50%
50%

Cloud Can Simplify Vulnerability Management For SMBs

Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities

Even with a relatively small number of systems, tracking down and triaging vulnerabilities is a complex enough task that many small and midsize businesses (SMB) set their systems to automatically update software and rarely check the results.

For SMBs, finding an employee with the expertise and time to catalog the devices connected to the network and routine scan for vulnerabilities is tough, says Kiran Kumar, product manager at vulnerability management firm Qualys. Most often, companies do occasional vulnerability scanning as part of the requirements necessary to comply with security standards, such as the Payment Card Industry's Data Security Standard (PCI-DSS). But companies that want better security need to do more than that, he says.

"We all know they have very limited IT resources and time, but this is a key area that they need for security," Kumar says. "While some of them just do it for their quarterly scanning requirement, there are others that are building up a team, even with two people. They want to use this to reassure their customers and give them more security credibility."

Vulnerability and patch management are a critical part of keeping businesses and their networks safe. SMBs that rely on their firewalls and antivirus software to protect their servers and employees' systems are not doing enough: Continuously monitoring the vulnerabilities present in a company's network comes in at No. 4 on the SANS Institute's Top-20 list of critical security controls.

Enterprise-class vulnerability management is typically not well-suited for smaller businesses, but a wide variety of companies offer on-premise products that catalog a company's IT assets and then checks them for vulnerabilities. From GFI's LanGuard to VMware's vCenter Protect, and from Rapid7's Nexpose to Tenable's Nessus, the products and services run the gamut from barebones to a large feature set.

Yet a number of companies are specifically targeting SMBs and their lack of IT security knowledge with cloud services that audit networks, detect vulnerabilities, and helps companies remediate the issues.

[If the definition of insanity is doing the same thing over and over and expecting different results, then today's IT security departments may just be a little nutty about vulnerability management. See Is Vulnerability Management Broken?.]

In 2012, nCircle, now part of Tripwire, released its PureCloud offering that performs asset discovery and vulnerability assessment via a cloud service. IT management firm Kaseya has a full-features platform that includes vulnerability scanning and patch deployment. Vulnerability management firm Secunia adds patching as well, aiming to offer in a single service the ability to catalog issues and then patch the problems, according to Morten Stengaard, chief technology officer of the firm.

"We want to get to the point that, if you don't have a security team, then you can still secure your systems," Stengaard said during an interview at the RSA Security Conference earlier this year.

In July, Qualys will launch a SMB-focused version of its own vulnerability management tool, QualysGuard Express Lite. The service will scan for vulnerabilities inside the network, scan for Web application vulnerabilities externally, and product compliance reports, Qualys's Kumar says.

"Basically, we want to help them turn scanning into something that keeps on happening automatically," he says. "We want the SMBs to really focus on growing their business."

Kumar and others stress that companies should not treat vulnerability management as a compliance exercise. Recent reports suggest that companies that focus on their security -- and use the cloud to provide secure services -- have a higher level of security and more success. A study sponsored by Microsoft, for example, found that six out of 10 companies that do not use the cloud cite security concerns as a primary reason, but that 94 percent of SMBs that adopted the cloud say it improved their security posture.

In a study released this week, security firm Symantec found that 78 percent of the top-performing third of SMBs felt they were at least somewhat secure, compared to only 39 percent of the worst-performing third. In addition, losses from successful attacks were 51 percent lower than the poor performers, said Andrew Singer, director of product marketing for small business at Symantec, in an e-mail interview.

"While we didn’t ask specifically about how they deal with vulnerabilities and patch management, it stands to reason that the top-ranking SMBs who make IT a priority are better able to deal with vulnerability-related issues," he said.

In addition to taking advantage of the expertise incorporated into cloud services, SMBs should also apply patches as soon as possible and block access to all internal systems from outside the network, he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13100
PUBLISHED: 2020-10-26
Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and restart) in the ControllerOob agent via a malformed control-plane packet.
CVE-2020-25470
PUBLISHED: 2020-10-26
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.
CVE-2020-7751
PUBLISHED: 2020-10-26
This affects all versions of package pathval.
CVE-2020-27678
PUBLISHED: 2020-10-26
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
CVE-2020-27388
PUBLISHED: 2020-10-23
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.